This privacy policy is intended to help you understand how your personal data is collected, processed and stored by KINTHIA through the Site.
KINTHIA understands that the protection of data and privacy is an important issue for all users visiting the Site.
In accordance with the GDPR, KINTHIA undertakes to respect your privacy and to protect your personal data, that is to say data likely to identify you, directly or indirectly, as an individual.
The purpose of this privacy policy is to present KINTHIA’s commitments in this area.
Definition
When you use our Site, we may ask you to provide us with personal data about you.
The term “personal data” refers to any data that makes it possible to identify an individual, which includes in particular your last name, first names, pseudonym, photograph, postal and email address, job title, telephone numbers, date of birth, data relating to your transactions on the Site, details of your purchases, bank card numbers, SIRET number, intra-community VAT number, IP address, as well as any other information about yourself that you choose to provide to us.
Purpose
The purpose of this policy (hereinafter the “Policy”) is to inform you of the means we implement to collect your personal data, in the strictest compliance with your rights.
In this regard, we inform you that, in collecting and managing your personal data, we comply with French Law No. 78-17 of January 6, 1978 on information technology, data files and civil liberties, as currently in force (hereinafter the “Loi Informatique et Libertés”, the French Data Protection Act), as well as with Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”).
Identity of the party responsible for collecting the data
The party responsible for collecting your personal data is the company GHECNT, a SAS (French simplified joint-stock company) with share capital of 1000 euros, registered with the Pontoise Trade and Companies Register (RCS) under No. 930 237 623, with its registered office at 40 rue du Val de Glatigny, 95280 Jouy le Moutier (hereinafter referred to as “We”).
Collection of personal data
The legal basis for our collection of your personal data is as follows:
- this collection is necessary to perform the contract entered into when you use our services on our Site;
- legitimate interest, when you voluntarily provide us with personal data during your visit to our Site, the data then being collected to enable us to better respond to your requests for information about our services.
Your personal data is collected for one or more of the following purposes:
- Managing your access to, and use of, certain services available on the Site,
- Carrying out operations relating to Customer management with regard to contracts, invoices and the follow-up of the relationship with Customers,
- Building a file of users, customers and prospects,
- Sending newsletters, solicitations and promotional messages. Should you not wish to receive them, we give you the option of expressing your refusal when your data is collected,
- Producing commercial statistics and statistics on the use of our services,
- Organizing contests, lotteries and any promotional operations, excluding online gambling and games of chance subject to approval by the Autorité de Régulation des Jeux en ligne (French online gaming regulatory authority)
- Managing reviews by individuals of products, services or content,
- Managing unpaid amounts and any disputes relating to the use of our products and services,
- Personalizing responses to your requests for information,
- Complying with our legal and regulatory obligations. When collecting your personal data, we inform you whether certain data must be provided or is optional (by means of asterisks visible on the Site).
| Why do we collect your personal data? | What categories of personal data do we collect for this purpose? | What is the legal basis authorizing us to collect your personal data for such a purpose? |
|---|---|---|
| We collect your personal data in order to identify you when you use our site and to send you messages related to the proper administration of our site (e.g. registration confirmation, changes to the site or to the terms of use, etc.) | 
Identification data
Connection data
| The legal basis for this processing is the performance of the contract binding us upon your acceptance of our general terms and conditions when creating your account |
| We collect your personal data in order to deliver your order/service to you. |
Identification data
| The legal basis for this processing is the performance of the contract binding us upon your acceptance of our general terms and conditions when creating your account |
| We collect your personal data in order to improve and optimize our site, for example by studying your behavior during your visit and drawing conclusions from it in order to make changes in terms of ergonomics and user experience. | 
Usage and consumption data
Connection data
| The legal basis for this processing is our legitimate interest in providing and improving the user experience of our site’s visitors and members. |
| We collect your personal data in order to understand your preferences and to offer you commercial offers for services/products similar to those already ordered. |
Usage and consumption data
Identification data
| The legal basis for this processing is our legitimate interest in providing and improving the user experience of our site’s visitors and members. |
When collecting your personal data, we inform you whether certain data must be provided or is optional.
Recipients of personal data
The following will have access to your personal data:
- The staff of our company;
- The departments responsible for oversight (in particular lawyer and accountant);
- Our processors (communication providers, productivity software providers, data hosting provider, payment service providers, invoicing provider, analytics and audience measurement providers, customer relationship management providers);
- Your personal data may also be disclosed to public bodies (exclusively in order to meet our legal obligations), officers of the court, ministerial officers and bodies responsible for debt collection.
Retention period of personal data
Regarding data relating to the management of customers and prospects:
Your personal data will not be retained beyond the period strictly necessary to manage our business relationship with you.
However, data used to establish proof of a right or a contract, which must be retained in order to comply with a legal obligation, will be retained for the period provided for by the law in force.
With regard to any prospecting operations aimed at customers, their data may be retained for a period of three (3) years from the end of the business relationship.
Personal data relating to a prospect who is not a customer may be retained for a period of three (3) years from its collection or from the last contact initiated by the prospect.
At the end of this three (3) year period, we may contact you again to find out whether you wish to continue receiving commercial solicitations.
Where the right of access or rectification is exercised, data relating to identity documents may be retained for the period provided for in Article 9 of the French Code of Criminal Procedure, i.e. one (1) year. Where the right to object is exercised, this data may be archived for the limitation period provided for in Article 8 of the French Code of Criminal Procedure, i.e. three (3) years.
Financial transactions relating to the payment of purchases and fees via the Site are entrusted to a payment service provider, which ensures that they are carried out properly and securely.
For the purposes of the services, this payment service provider may receive your personal data relating to your bank card numbers, which it collects and retains in our name and on our behalf. We do not have access to this data.
To enable you to make regular purchases or pay the related fees on the Site, your bank card data is retained for as long as you are registered on the Site and, at the very least, until you make your last transaction.
Data relating to the card verification code, or CVV2, printed on your bank card is not stored.
If you refuse to allow your personal data relating to your bank card numbers to be retained under the conditions specified above, we will not retain this data beyond the time necessary to complete the transaction.
In any event, data relating to these cards may be retained in intermediate archives, as evidence in the event of a possible dispute of the transaction, for the period provided for by Article L 133-24 of the French Monetary and Financial Code, namely thirteen (13) months following the debit date. This period may be extended to fifteen (15) months in order to take into account the possible use of deferred debit payment cards.
Regarding the management of lists of persons objecting to receiving prospecting:
The information used to take your right to object into account is retained for at least three (3) years from the exercise of the right to object.
Regarding audience measurement statistics:
Information stored in users’ devices, or any other element used to identify users and enabling their tracking or the tracking of their visits, will not be retained beyond thirteen (13) months.
Security
We inform you that we take all useful precautions and appropriate organizational and technical measures to preserve the security, integrity and confidentiality of your personal data and, in particular, to prevent it from being distorted, damaged or accessed by unauthorized third parties. We also use secure payment systems that comply with the state of the art and with applicable regulations.
Hosting
We inform you that your data is retained and stored, throughout its retention period, on the servers of the company OVH, located in the European Union.
Transfer outside the European Union
Your data may be transferred outside the European Union in connection with the tools we use and our relationships with our processors.
This transfer is secured by the following means:
- Either this data is transferred to a country that has been deemed, by a decision of the European Commission, to offer an adequate level of protection;
- Or we have entered into a specific contract with our processors governing transfers of your data outside the European Union, based on the standard contractual clauses between a controller and a processor approved by the European Commission.
Access, rectification, restriction and erasure of your personal data
In accordance with European regulations on the protection of personal data, you have the following rights:
- A right of access, allowing you at any time to know whether or not your personal data is being processed by our services and, where it is, to have access to that personal data and to the information required by law concerning the terms of its processing,
- A right to rectification, allowing you to request that any inaccuracy concerning your personal data be corrected as soon as possible,
- A right to erasure, allowing you to request that your personal data be erased as soon as possible, provided that this request for erasure meets the conditions required by applicable law,
- A right to restriction of the processing of your personal data, provided that this request for restriction meets the conditions required by applicable law,
- A right to data portability, allowing you to receive your personal data in a structured, commonly used and machine-readable format, or to request that this personal data be transmitted to another controller, provided that this request for portability meets the conditions required by applicable law,
- A right to object to the processing of your personal data on grounds relating to your particular situation, provided that this objection meets the conditions required by applicable law,
- The right to withdraw at any time the specific consent given to the collection of your personal data, in particular where the processing of your personal data is used for commercial prospecting purposes,
- The right to set guidelines regarding the retention, erasure and communication of your personal data after your death.
You have the right to obtain restriction of the processing of your personal data in the cases defined in Article 18 of the GDPR:
- During the verification period that we carry out, when you contest the accuracy of your personal data,
- When the processing of this data is unlawful and you wish to restrict this processing rather than have your data deleted,
- When we no longer need your personal data but you wish it to be retained in order to exercise your rights,
- During the period of verification of legitimate grounds, when you have objected to the processing of your personal data.
Persons whose data is collected on the basis of our legitimate interest are reminded that they may object at any time to the processing of data concerning them. We may, however, continue the processing if there are legitimate grounds for the processing which override your rights and freedoms or if the processing is necessary for the establishment, exercise or defense of our legal claims.
You can unsubscribe from our promotional emails via the link provided in those emails. Even if you choose to no longer receive promotional messages from us, you will continue to receive our administrative messages.
Portability of your personal data
You have a right to the portability of the personal data you have provided to us, understood as the data you have actively and knowingly declared in the context of accessing and using the services, as well as the data generated by your activity in the context of using the services.
We remind you that this right does not apply to data collected and processed on a legal basis other than consent or the performance of the contract binding us.
This right may be exercised free of charge, at any time, and in particular when closing your account on the Site, in order to retrieve and retain your personal data.
In this context, we will send you your personal data, by any means deemed useful, in an open, standard, commonly used and machine-readable format, in accordance with the state of the art.
Filing a complaint with a supervisory authority
You are also informed that you have the right to file a complaint with a competent supervisory authority (for France, the Commission Nationale de l’Informatique et des Libertés, or CNIL, the French data protection authority) in the Member State of your habitual residence, of your place of work or of the place where the alleged infringement of your rights was committed, if you consider that the processing of your personal data covered by this Policy infringes the applicable legislation.
This complaint may be filed without prejudice to any other remedy before an administrative body or a court. Indeed, you also have the right to an effective administrative or judicial remedy if you consider that the processing of your personal data covered by this Policy infringes the applicable legislation.
Changes
We reserve the right, at our sole discretion, to modify this Policy in whole or in part at any time.
These changes will take effect upon publication of the new Policy.